The Policy covers users of Hugging Face services and is part of the Terms of Use
This Privacy Policy is issued by Hugging Face, Inc. (called "the Company") and describes what information the Company gathers from users of the Hugging Face services and how it uses that information. It applies to all users of the Services, and it states that it is part of the Company Terms of Use. The document shows an effective date of March 28, 2023.
Supporting quotations
Effective Date: March 28, 2023
This Privacy Policy (the “Policy”) describes the type of information that Hugging Face, Inc. (the “Company”) gathers from users of the Hugging Face services (the “Services”), and how the Company uses that information.
The Policy is part of the Company Terms of Use. The Policy applies to all users of the Services (“Users”).
Qualifications & exceptions
"Users" and "Services" are the terms this Policy defines for itself; the Services are described only as "the Hugging Face services".
Not stated here
The Terms of Use that this Policy says it is part of are not part of this source text, so their contents are not described here.
Data Access & Collection · Context
"Personal Information" means any information that can identify an individual, alone or combined
The Policy says the Company occasionally collects Personal Information from Users. It defines Personal Information as any information that can, alone or associated with other information, be used to identify an individual, for instance through a name, a username, an email address, an IP address, a photograph or others. The list of examples is introduced with "for instance", so it is not stated to be complete.
Supporting quotations
The Company occasionally collects Personal Information from Users. “Personal Information” means any information that can, alone or associated with other information, be used to identify an individual, for instance by reference of a name, a username, an email address, an IP address, a photograph or others.
Legal Rights & Agreement Rules · Company practice
Using the Services is treated as consent to the Policy and to processing of Personal Information
The Policy states that by using the Services you consent to its terms and to the Company processing Personal Information in the manner and for the purposes the Policy sets out. It also says that by creating an account on the Website and using the Services you consent to disclose information, some of which might be personal, and to that processing. If you do not agree with the Policy, it asks you not to use the Services. This describes how the Policy characterizes use of the Services; it does not say whether that characterization is effective in a particular legal system.
Supporting quotations
By using the Services, you consent to the terms of the Policy and to our processing of Personal Information in the manner and for the purposes set forth herein. If you do not agree with the Policy, please do not use the Services.
By creating an account on the Website and by using the Services, you consent to disclose information, some of which might be personal, and to our processing of such Personal Information in the manner and for the purposes set forth in this Policy.
Qualifications & exceptions
The consent described is tied to processing "in the manner and for the purposes set forth" in the Policy.
Not stated here
This passage does not itself describe how this consent can be withdrawn.
Legal Rights & Agreement Rules · Permission or license
The Company may change the Policy at any time; changes take effect 10 days after posting
The Company reserves the right, at its sole discretion, to change the Policy at any time. A change takes effect 10 days after the revised Policy is posted on the Hugging Face website. The Policy says that continuing to use the Services 10 days after that posting means you accept the changes.
Supporting quotations
The Company reserves the right, at its sole discretion, to change the Policy at any time, which change will be effective 10 days following posting the revision to the Policy on the Hugging Face website (the “Website”). Your continued use of the Services 10 days following such posting means you accept those changes.
Not stated here
This passage does not say whether users are told of a change in any way other than posting on the Website.
Data Access & Collection · Company practice
The Company collects account setup details such as email, password, username and full name
The Company collects information that Users provide directly while using the Services. For setting up an account on the Website this includes email address, password, username and full name, plus optional information such as an avatar, your interests, or usernames for your third-party social networks. The Policy introduces the information collected as information "some of which might be Personal Information", and the lists are introduced with "such as", so they are not stated to be exhaustive.
Supporting quotations
The Company collects the following information, some of which might be Personal Information.
The Company collects information directly provided by Users as part of using the Services, such as:
information provided as part of setting up an account on the Website: email address, password, username, full name, and other optional information such as an avatar, your interests, or usernames to your third-party social networks,
Qualifications & exceptions
An avatar, interests and social-network usernames are described as optional; email address, password, username and full name are not described as optional in this passage.
Charges & Financial Obligations · Company practice
Credit card information is collected if you upgrade a user or organization account
The Company collects payment information, described as credit card information, that you provide if you decide to upgrade your user or organization account.
Supporting quotations
payment information provided, if you decide to upgrade your user or organization account: credit card information,
Qualifications & exceptions
The collection is described as applying to users who choose to upgrade a user or organization account.
Not stated here
This passage does not say which service providers handle payment information or how it is used beyond the purposes listed elsewhere in the Policy.
Data Access & Collection · Company practice
The Company collects content you post on the Website and communications between you and the Company
Among the information the Company collects directly are other information and materials that you decide to post on the Website (the examples given are the discussion forum "or other") and communications between you and the Company made as part of using the Services.
Supporting quotations
other information and materials that you decide to post on the Website (e.g., the discussion forum, or other),
communications between you and the Company, as part of using the Services.
Qualifications & exceptions
Posted materials are collected where the user decides to post them on the Website.
Sharing & Disclosure · User right or choice
You choose whether content is shared publicly or kept private; public Personal Information can be viewed by anyone
The Policy says that at any time you may decide to share some information or content publicly or privately. If you share information publicly and include Personal Information, you understand that anyone may view it. If you keep information private and control access to it, you understand that only the users you authorize will view it.
Supporting quotations
At any time during your use of the Services, you may decide to share some information or content publicly or privately.
If you decide to share your information or content publicly, and if you decide to include Personal Information, you understand that anyone may view this information.
If you decide to keep your information private and control the access to it, you understand that only the users that you authorize will view this information.
Qualifications & exceptions
The statement about private information is subject to the Company access described in the next card: the Company reserves a right to access private information with consent, or without consent only for stated purposes.
Use & Processing · Permission or license
The Company reserves the right to access your private information, without consent only for stated purposes
The Company reserves the right to access information you keep private. It may do so with your consent. Without your consent, it says it may access that information only for the purposes of pursuing legitimate interests, with maintaining security on its Services and complying with legal or regulatory obligations given as examples ("such as"). The examples are not stated to be the only legitimate interests.
Supporting quotations
The Company also reserves the right to access this information with your consent, or without your consent only for the purposes of pursuing legitimate interests such as maintaining security on its Services or complying with any legal or regulatory obligations.
Qualifications & exceptions
Access without consent is limited by the words "only for the purposes of pursuing legitimate interests such as" security and legal or regulatory compliance.
Not stated here
This passage does not define "legitimate interests". The Policy separately describes "Legitimate Interests" in its section on grounds for use of information, but this passage does not say that the two are the same.
Data Access & Collection · Company practice
The Company may collect information from third parties that help deliver the Services or process information
The Company says it may collect information from third parties that help it deliver the Services or process information.
Supporting quotations
We may collect Information from third parties that help us deliver the Services or process information.
Qualifications & exceptions
The sentence says "may", so collection from third parties is permitted rather than stated as certain.
Not stated here
The passage does not identify which third parties provide information or what kinds of information they provide.
Data Access & Collection · Company practice
The Company automatically records session, IP address, cookie and device information
The Company automatically records information from your use of the Services. The examples given are information about your use of the Services and your session (date and location), your IP address, information from cookies (especially login information and preferences), and information about your device (type, model, version, operating system and browser). The list is introduced with "such as", so it is not stated to be complete.
Supporting quotations
The Company automatically records information from your use of the Services such as:
information about your Use of the Services, your session (date, location), your IP address,
information from cookies, especially your login information, your preferences,
information about your device: type, model, version, operating system, browser
Data Access & Collection · Company practice
Cookies are used only for stated purposes; disabling them means you cannot access and use the Services
The Company says it uses cookies only for delivering, updating, monitoring and improving the Services, and for maintaining security by detecting, preventing and responding to threats or incidents. It may collect Information through those cookies. If you do not wish to accept the cookies and decide to disable them, the Policy says you will not be able to access and use the Services.
Supporting quotations
We use cookies only for the purposes of delivering, updating, monitoring, improving the Services, and maintaining security on our Services by detecting, preventing and responding to any type of threats or incidents.
We may collect Information through those cookies. If you do not wish to accept these cookies and you decide to disable them, you will not be able to access and use the Services.
Qualifications & exceptions
The purposes are stated as the only purposes for cookies ("only for the purposes of").
This passage states the consequence of disabling cookies without distinguishing between particular cookies.
Not stated here
The Policy does not list individual cookies or say which of them are required. The "Do Not Track" section says the Company does not use cookies when a "do not track" mechanism is in place; this passage does not say how that fits with the statement that disabling cookies blocks access.
Data Access & Collection · Company commitment
The Company says it honors "do not track" signals: no tracking, cookies or advertising when one is in place
The Policy gives as background that California enacted A.B. 370 on September 27, 2013, amending the California Online Privacy Protection Act to require website operators to disclose how they respond to "Do Not Track Signals" and whether third parties collect personally identifiable information about users on online services. The Company then states that it honors "do not track" signals and does not track, use cookies, or use advertising when a "do not track" mechanism is in place.
Supporting quotations
On September 27, 2013, California enacted A.B. 370, amending the California Online Privacy Protection Act to require website operators to disclose how they respond to "Do Not Track Signals"; and whether third parties collect personally identifiable information about users when they use online services.
The Company honors "do not track" signals and does not track, use cookies, or use advertising when a “do not track” mechanism is in place.
Qualifications & exceptions
The commitment applies when a "do not track" mechanism is in place.
Not stated here
The Policy does not define "track" or say what counts as a "do not track" mechanism, and does not say how this commitment fits with the cookie use described in the Cookies section.
Data Access & Collection · Company commitment
No authorization to collect identifiable information for third-party advertising use without separate consent
The Company says it does not authorize the collection of personally identifiable information from its users for third-party use through advertising technologies without separate member consent.
Supporting quotations
The Company does not authorize the collection of personally identifiable information from our users for third party use through advertising technologies without separate member consent.
Qualifications & exceptions
The statement is limited to personally identifiable information, third-party use, and advertising technologies, and is conditioned on there being no separate member consent.
Not stated here
The passage does not describe how separate member consent is requested or given.
Legal Rights & Agreement Rules · User right or choice
California residents can request information about disclosures for direct marketing; one response per year
The Policy says California Civil Code Section 1798.83 permits customers who are California residents to request certain information about the Company's disclosure of Personal Information to third parties for direct marketing purposes. To make such a request, send an email to privacy@huggingface.co. The Company states that it is only required to respond to one request per customer each year.
Supporting quotations
California Civil Code Section 1798.83 also permits customers who are California residents to request certain information regarding Our disclosure of Personal Information to third parties for direct marketing purposes. To make such a request, please send an email to privacy@huggingface.co. Please note that the Company is only required to respond to one request per customer each year.
Qualifications & exceptions
The right described is for customers who are California residents, and covers disclosures to third parties for direct marketing purposes.
The Company states it need respond to only one request per customer each year.
Not stated here
The text of California Civil Code Section 1798.83 is not part of this source, so the full scope of the information that can be requested is not stated here.
The passage says "customers" rather than "Users", and does not say how the two terms relate.
Use & Processing · Permission or license
The Company may use information from Users for the listed purposes; legitimate interests are described more broadly
The Policy says the Company may use information from Users for the purposes listed in this section. These cover delivering and improving the Services, analysis and research, communicating with you, security, protecting against harm, enforcing terms and complying with law; each is described in its own card. Separately, the grounds subsection says that, apart from the consent and agreement cases, the Company will use the information collected from you to pursue legitimate interests such as legal or regulatory compliance, security control, business operations, scientific research, or any other interest reasonably held as legitimate.
Supporting quotations
The Company may use information from Users for the following purposes:
Apart from the above cases, Hugging Face will use the information collected from you to pursue legitimate interests such as legal or regulatory compliance, security control, business operations, scientific research, or any other interest reasonably held as legitimate.
Qualifications & exceptions
The lead-in uses "may", so the listed uses are permitted rather than stated as certain for every user.
The "legitimate interests" wording includes "any other interest reasonably held as legitimate".
Not stated here
The text does not say whether the list of purposes is complete or how the broader legitimate interests ground relates to it.
Use & Processing · Permission or license
Information may be used to deliver the Services, including accounts, profile and content display, and paid upgrades
The Company may use information from Users to deliver the Services. The Policy says this may include creating your account, displaying your profile or your content, or, where applicable, upgrading your account to a paid account.
Supporting quotations
to deliver the Services, which may include the creation of Your account, the display of Your profile or Your content, or if applicable the upgrading of Your account to a paid account,
Qualifications & exceptions
The account, profile, content and upgrade items are introduced with "which may include", so they are examples rather than a complete list.
Use & Processing · Permission or license
Information may be used to operate and improve the Services and the Company's other products and technologies
The Company may use information to operate and improve the Services. The listed examples are providing more effective customer service, making the Services easier to use by removing the need to re-enter the same information, performing research and analysis aimed at improving the Services or other products and technologies of the Company, automatically updating the Services, and diagnosing or fixing problems with the Services. So the stated improvement purpose reaches other Company products and technologies as well as the Services.
Supporting quotations
to operate and improve the Services by providing you with more effective customer service, making the Services easier to use by eliminating the need for you to enter the same information repeatedly; performing research and analysis aimed at improving the Services, or other products and technologies of the Company; automatically updating the Services; diagnosing or fixing problems with the Services,
Use & Processing · Permission or license
Information may be used for analysis or research on the Services or related topics, for business or scientific purposes
The Company may use information from Users to conduct analysis or research on the Services or any topics related to them, for business operations or scientific purposes.
Supporting quotations
to conduct analysis or research on the Services or any topics related to it, for business operations or scientific purposes,
Qualifications & exceptions
The research may cover "any topics related to" the Services and is described as being for business operations or scientific purposes.
Not stated here
The text does not say whether information is de-identified or aggregated for this research.
Use & Processing · Permission or license
Information may be used to communicate with you, including about anything the Company thinks may interest you
The Company may use information from Users to communicate with you. The examples given are welcome emails, information on technical service issues, security announcements, information on new services available, legal notices and responses to your requests. The Policy also lists "any other information that we think might interest or be relevant to you", which covers communications whose subject the Company chooses.
Supporting quotations
to communicate with you, especially through the sending of welcome emails, information on technical service issues, security announcements, information of new services available, legal notices, response to your requests, or any other information that we think might interest or be relevant to you,
Qualifications & exceptions
The scope of communications includes "any other information that we think might interest or be relevant to you".
Not stated here
This passage does not say whether you can opt out of these communications; the Policy's section on communications and email is a separate part of the Policy.
Security & Safeguards · Permission or license
Information may be used for security; disclosure without consent is separately reserved for security purposes
The Company may use information to ensure and maintain security on its Services or Website, which may include detecting, preventing, investigating or otherwise addressing fraud or security issues. In the sharing section, the Company separately reserves the right, in the event of any fraud, security threats or incidents, to disclose your information without your consent for the purposes of ensuring and maintaining security on its Website and for all of its Users, and of detecting, preventing, investigating or otherwise addressing fraud or security issues.
Supporting quotations
to ensure and maintain security on our Services or Website, which may include detecting, preventing, investigating or otherwise addressing fraud or security issues,
In the event of any fraud, security threats or incidents, we reserve the right to disclose your information without your consent for the purposes of ensuring and maintaining security on our Website and for all of our Users, and detecting, preventing, investigating or otherwise addressing fraud or security issues.
Qualifications & exceptions
The disclosure right is stated for "any fraud, security threats or incidents" and is limited to the security purposes named in that paragraph.
Use & Processing · Permission or license
Information may be used to protect against harm and enforce terms; disclosure without consent is reserved for harm
The Company may use information to protect against harm to the rights, property or safety of the Company, its Users, yourself or the public, and to enforce any applicable terms of service or agreement, including investigating potential violations. In the sharing section, the Company separately reserves the right to disclose your information without your consent for the purpose of protecting against harm to the rights, property or safety of the Company, its Users, yourself or the public. The disclosure right as written there refers to harm protection; it does not mention enforcing terms.
Supporting quotations
to protect against harm to the rights, property or safety of the Company, our Users, yourself or the public,
to enforce any applicable terms of service or agreement, including investigations of potential violations thereof,
Similarly, we reserve the right to disclose your information without your consent for the purpose of protecting against harm to the rights, property or safety of the Company, our Users, yourself or the public.
Qualifications & exceptions
The harm-protection purpose covers the Company, its Users, you, or the public.
Legal Rights & Agreement Rules · Permission or license
Information may be used to comply with law, regulation, legal process or governmental requests
The Company may use information from Users to comply with any applicable law, regulation, legal process or governmental requests.
Supporting quotations
to comply with any applicable law, regulation, legal process or governmental requests.
Legal Rights & Agreement Rules · Context
The Policy says GDPR and other data protection laws require it to state the legal basis for processing
The Policy says that under applicable data protection laws, especially the EU General Data Protection Regulation (EU) 2016/679, Hugging Face is under an obligation to notify Users of the legal basis on which their Personal Information is processed. It then sets out three headings: Consent, Agreement and Legitimate Interests. "Personal Information" is the Policy's defined term for information that can identify an individual.
Supporting quotations
Pursuant to applicable data protection laws, and especially the European Union’s General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.
“Personal Information” means any information that can, alone or associated with other information, be used to identify an individual
Qualifications & exceptions
The three grounds are described in the following cards.
Not stated here
The text does not say whether these grounds are meant to apply to all Users or only to those covered by the GDPR or other data protection laws.
Legal Rights & Agreement Rules · Context
Creating an account and using the Services is stated as consent to disclose information and to its processing
Under the heading "Consent", the Policy says that by creating an account on the Website and by using the Services you consent to disclose information, some of which might be personal, and to the Company's processing of such Personal Information in the manner and for the purposes set forth in the Policy.
Supporting quotations
Consent
By creating an account on the Website and by using the Services, you consent to disclose information, some of which might be personal, and to our processing of such Personal Information in the manner and for the purposes set forth in this Policy.
Qualifications & exceptions
The consent is tied to processing "in the manner and for the purposes set forth in this Policy".
Legal Rights & Agreement Rules · Context
Entering into an agreement with Hugging Face is stated as consent to processing under that agreement
Under the heading "Agreement", the Policy says that if you or your organization enter into an agreement with Hugging Face, either by simply using the Services and abiding by the terms and conditions available on the Website or by executing another separate agreement, you also consent to the processing of your Personal Information as pursuant to the obligations of such an agreement.
Supporting quotations
Agreement
If you or your organization enter into an agreement with Hugging Face, either by simply using the Services and abiding by the terms and conditions available on the Website, or by executing another separate agreement, you also consent to our processing of your Personal Information as pursuant the obligations of such an agreement.
Qualifications & exceptions
The agreement can be the terms available on the Website or a separate agreement; the consent is to processing "as pursuant the obligations of such an agreement".
Not stated here
The terms and any separate agreements referred to are not part of this source text, so the obligations that processing may follow from are not described here.
Use & Processing · Company practice
Apart from consent and agreement, the Company uses information to pursue legitimate interests, broadly described
Under the heading "Legitimate Interests", the Policy says that apart from the consent and agreement cases, Hugging Face will use the information collected from you to pursue legitimate interests such as legal or regulatory compliance, security control, business operations, scientific research, or any other interest reasonably held as legitimate. The examples are introduced with "such as" and the sentence ends with "any other interest reasonably held as legitimate", so the grounds are described without a closed list.
Supporting quotations
Legitimate Interests
Apart from the above cases, Hugging Face will use the information collected from you to pursue legitimate interests such as legal or regulatory compliance, security control, business operations, scientific research, or any other interest reasonably held as legitimate.
Qualifications & exceptions
The ground applies "apart from the above cases", meaning the consent and agreement cases.
Not stated here
The text does not say who decides what is reasonably held as legitimate.
Sharing & Disclosure · Company commitment
The Company will not sell, rent or lease Personal Information except as the Policy provides
The Company says it will not sell, rent or lease your Personal Information except as provided for by the Policy, and that it may also share other information as the Policy provides. "Personal Information" is the Policy's defined term for information that can identify an individual. The exception ("except as provided for by this Policy") refers to the other provisions of the Policy on sharing, such as affiliates, service providers, consent, security, legal disclosure and Anonymous Information, each described in its own card.
Supporting quotations
The Company will not sell, rent or lease your Personal Information except as provided for by this Policy. The Company may also share other information as provided by this Policy.
“Personal Information” means any information that can, alone or associated with other information, be used to identify an individual
Qualifications & exceptions
The commitment is qualified by "except as provided for by this Policy".
Not stated here
The sentence does not say which provisions it treats as exceptions, or whether any of the sharing the Policy describes is a sale, rental or lease.
Sharing & Disclosure · Permission or license
The Company may share User and Personal Information with group affiliates, including after a change of control
The Company may share User Information and Personal Information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (called "Affiliates"). In the transfers section the Policy also says the Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing it on the Company's behalf.
Supporting quotations
The Company may share User Information and Personal information collected by the Services with businesses that are legally part of the same group as the Company, or that become part of that group in the event of a change of control, merger, acquisition or sale (“Affiliates”).
The Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing such information on its behalf.
Qualifications & exceptions
Affiliates include businesses that become part of the group through a change of control, merger, acquisition or sale.
Not stated here
"User Information" is not separately defined in the text supplied, and this passage does not limit the purposes for which Affiliates may use what they receive; the transfers sentence names storing or processing on the Company's behalf as a purpose for transfers to affiliated companies.
Sharing & Disclosure · Company commitment
Service providers may receive only the Personal Information they need and may not use it for other purposes
The Company says it may occasionally hire other companies to provide limited services on its behalf, such as customer support, hosting websites, processing transactions or statistical analysis of its Services. Those companies will be permitted to obtain only the Personal Information they need to deliver the relevant service, will be required to maintain confidentiality, and are prohibited from using the information for any other purpose. The Policy points to its list of Third Party Service Providers.
Supporting quotations
The Company may occasionally hire other companies to provide limited services on its behalf, such as providing customer support, hosting websites, processing transactions, or performing statistical analysis of its Services. Those companies will be permitted to obtain only the Personal Information they need to deliver the relevant service. They will be required to maintain the confidentiality of the information and are prohibited from using it for any other purpose. Please refer to the list of Third Party Service Providers below.
Qualifications & exceptions
The examples of services are introduced with "such as" and are not stated to be exhaustive.
Not stated here
The mechanism by which the Company requires confidentiality and limits use by these companies is not described in this passage.
Sharing & Disclosure · User right or choice
You may consent to the disclosure of your information at any time or when the Company asks
The Policy says that at any time during your use of the Services, or upon explicit request from the Company, you may consent to the disclosure of your information.
Supporting quotations
At any time during your use of the Services, or upon explicit request from us, you may consent to the disclosure of your information.
Not stated here
The passage does not say to whom information may be disclosed under such consent or how consent is given.
Sharing & Disclosure · Permission or license
The Company reserves the right to disclose your information without consent for security and harm protection
The Company reserves the right to disclose your information without your consent in two situations. First, in the event of any fraud, security threats or incidents, for the purposes of ensuring and maintaining security on its Website and for all of its Users, and of detecting, preventing, investigating or otherwise addressing fraud or security issues. Second, for the purpose of protecting against harm to the rights, property or safety of the Company, its Users, you or the public.
Supporting quotations
In the event of any fraud, security threats or incidents, we reserve the right to disclose your information without your consent for the purposes of ensuring and maintaining security on our Website and for all of our Users, and detecting, preventing, investigating or otherwise addressing fraud or security issues.
Similarly, we reserve the right to disclose your information without your consent for the purpose of protecting against harm to the rights, property or safety of the Company, our Users, yourself or the public.
Qualifications & exceptions
The first right is tied to fraud, security threats or incidents; the second is tied to protection against harm to rights, property or safety.
Not stated here
The passages do not say to whom the information may be disclosed.
Sharing & Disclosure · Permission or license
The Company reserves the right to disclose your information without consent to comply with law or legal requests
The Company reserves the right to disclose your information without your consent to comply with any applicable law, regulation, legal process or governmental requests.
Supporting quotations
We also reserve the right to disclose your information without your consent to comply with any applicable law, regulation, legal process or governmental requests.
Not stated here
The passage does not say to whom the information may be disclosed or whether the Company notifies the user.
Use & Processing · Context
"Anonymous Information" means information that does not enable identification of an individual User
The Policy defines "Anonymous Information" as information which does not enable identification of an individual User, such as aggregated information about use of the Services.
Supporting quotations
"Anonymous Information" means information which does not enable identification of an individual User, such as aggregated information about use of the Services.
Qualifications & exceptions
The aggregated usage information is given as an example ("such as"), not as the whole definition.
Sharing & Disclosure · Permission or license
Anonymous Information may be disclosed, with or without compensation, to third parties including advertisers
The Company may use Anonymous Information, or disclose it to third party service providers, to provide and improve the Services and other products or technologies of the Company. It may also disclose Anonymous Information, with or without compensation, to third parties including advertisers and partners, for purposes including, but not limited to, targeting advertisements. The permission is described for Anonymous Information, which the Policy defines as information that does not enable identification of an individual User.
Supporting quotations
The Company may use Anonymous Information (as defined below) or disclose it to third party service providers, to provide and improve the Services and other products or technologies of the Company. The Company may disclose Anonymous Information (with or without compensation) to third parties, including advertisers and partners, for purposes including, but not limited to, targeting advertisements.
Qualifications & exceptions
The stated purposes for disclosure to third parties are not limited to targeting advertisements ("including, but not limited to").
The permission covers disclosure "with or without compensation".
Not stated here
The passage does not say how information is anonymized, who the "partners" are, or whether disclosure to advertisers is limited to a particular kind of Anonymous Information.
Account & Service Control · User right or choice
You may be entitled under data protection laws to access your Personal Information; send other requests by email
The Policy says you may be entitled under data protection laws to access and review the Personal Information the Company holds about you. For any other request, communications about access to Personal Information should be sent to privacy@huggingface.co. Such inquiries should be clearly marked as data protection queries, and you should indicate if the request is time sensitive.
Supporting quotations
You may be entitled under data protection laws to access and review Personal Information the Company holds related to you.
If you have any other request, all such communications regarding access to Personal Information should be addressed to: privacy@huggingface.co. Such inquiries should be clearly marked as data protection queries and you should indicate if the request is time sensitive.
Qualifications & exceptions
The access entitlement is described as one you "may be entitled" to "under data protection laws", not as a right the Policy itself grants without condition.
Not stated here
The passage does not state a response time for these requests.
Account & Service Control · User right or choice
You may access, modify or delete collected information by editing your profile or controlling shared content
The Policy says you may access, modify or delete the Information the Company collected by editing your profile or controlling the content that you share, at any time.
Supporting quotations
You may access, modify or delete the Information we collected by editing your profile or controlling the content that you share at any time.
Qualifications & exceptions
The stated means are editing your profile or controlling the content you share.
Not stated here
The passage does not say whether information outside the profile and shared content, such as information recorded automatically, can be accessed, modified or deleted this way.
Retention & Deletion · Company practice
Information is retained as long as needed to deliver the Services, meet legal requirements, and for legitimate interests
The Company says it retains your Information for as long as necessary to deliver the Services, to comply with applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue its legitimate interests. The Policy states no fixed retention period in this passage.
Supporting quotations
We retain your Information for as long as necessary to deliver the Services, to comply with any applicable legal requirements, to maintain security and prevent incidents and, in general, to pursue our legitimate interests.
Qualifications & exceptions
The last stated reason is "in general, to pursue our legitimate interests", which is broad.
Not stated here
This passage does not state specific retention periods or say which data is kept for which reason.
Retention & Deletion · User right or choice
You may cancel your account by editing your profile and request erasure of your Personal Information in writing
The Policy says you may decide to cancel your account and your content at any time by editing your profile. If you want to request erasure of all of your Personal Information that the Company processes, you may do so by sending a written request to privacy@huggingface.co.
Supporting quotations
You may decide to cancel your account and your content at any time by editing your profile. If you wish to request the erasure of all of your Personal Information that we process, you may do so by sending a written request to privacy@huggingface.co.
Not stated here
The passage does not say whether the retention purposes described in the previous paragraph limit an erasure request, or how long the Company takes to respond.
Security & Safeguards · Company practice
The Company uses industry-standard safeguards but states it cannot guarantee absolute security or confidentiality
The Company says it follows generally accepted industry standards, including appropriate administrative, physical and technical safeguards, to protect Personal Information. It also states that no method of transmission over the Internet or of electronic storage is fully secure, and that while it strives to use commercially acceptable means, it cannot guarantee absolute security or confidentiality of Personal Information. Questions about security can be sent to privacy@huggingface.co.
Supporting quotations
The Company follows generally accepted industry standards, including the use of appropriate administrative, physical and technical safeguards, to protect Personal Information. However, no method of transmission over the Internet, or method of electronic storage, is fully secure. Therefore, while the Company strives to use commercially acceptable means to protect Personal Information, the Company cannot guarantee its absolute security or confidentiality. If you have any questions about security, you can contact the Company at privacy@huggingface.co.
Qualifications & exceptions
The safeguards commitment is paired with an express statement that absolute security or confidentiality is not guaranteed.
Security & Safeguards · Company commitment
In an incident affecting Personal Information, the Company says it will act promptly to address it and notify you
The Policy says that in the event of an incident affecting your Personal Information, the Company will act promptly "acceptable means" to identify and address the incident, and to notify you. The wording of this sentence is garbled in the source ("act promptly acceptable means"), so the exact standard for how the Company acts is unclear.
Supporting quotations
In the event of an incident affecting your Personal Information, we will act promptly acceptable means to identify and address the incident, and to notify you.
Not stated here
The sentence is grammatically incomplete as written. It sets no deadline for notification and does not describe how notice will be given.
Security & Safeguards · Restriction or exception
You are solely responsible for the security of your device and the confidentiality of your password
The Policy tells you that certain Personal Information and other information you provide while using the Services may be stored on your device, even if the Company does not collect it. It says you are solely responsible for keeping your device secure from unauthorized access, and that you remain responsible for the confidentiality of your password or any other information that should reasonably be held confidential.
Supporting quotations
Please be aware that certain Personal Information and other information provided by you in connection with your use of the Services may be stored on your device (even if that Information is not collected by the Company). You are solely responsible for maintaining the security of your device from unauthorized access. Similarly, you also remain responsible for maintaining the confidentiality of your password or any other information that should reasonably be held confidential.
Qualifications & exceptions
The device responsibility is stated as "solely responsible"; the password and confidentiality responsibility is stated as "remain responsible".
Use & Processing · Company practice
Personal Information may be stored and processed in the US or any country where the Company or its affiliates operate
The Policy states that the Company and its servers are located in the United States. Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. It also says that by using the Services you consent to any such transfer of information outside of your country.
Supporting quotations
The Company and its servers are located in the United States.
Personal Information collected by the Services may be stored and processed in the United States or any other country in which the Company or its affiliates, subsidiaries or agents maintain facilities. By using the Services, you consent to any such transfer of information outside of your country.
“Personal Information” means any information that can, alone or associated with other information, be used to identify an individual
Qualifications & exceptions
Consent to transfers outside your country is tied to using the Services.
The countries are not listed; the test is where the Company, its affiliates, subsidiaries or agents "maintain facilities".
Not stated here
This passage does not name the countries other than the United States.
Sharing & Disclosure · Permission or license
Personal Information may go to affiliated companies and other countries; the Company requires them to follow the Policy
The Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing it on the Company's behalf. The information may be transferred to other countries around the world. The Policy says the Company requires "these parties" to agree to process the information in compliance with the Policy.
Supporting quotations
The Company may transfer your Personal Information to affiliated companies for the purpose of storing or processing such information on its behalf. Such information may be transferred to other countries around the world. The Company requires that these parties agree to process such information in compliance with the Policy.
Qualifications & exceptions
The stated purpose for transfers to affiliated companies is storing or processing on the Company's behalf.
Not stated here
The passage says "these parties" without stating whether it means the affiliated companies, subsidiaries, agents or all of them, and does not describe how the agreement is made.
Use & Processing · Company commitment
Personal Information you provide may be processed in the US and other countries; the Company strives to apply safeguards
The Policy says that if you provide Personal Information, it may be transferred to and processed on computers in the U.S. and other countries. The Company says it strives to take appropriate safeguards so that your Personal Information remains protected in a manner consistent with standard applicable data protection laws. "Strive" describes an effort, not a guarantee.
Supporting quotations
In particular, if you provide Personal Information, it may be transferred to and processed on computers in the U.S. and other countries. We strive to take appropriate safeguards to ensure that your Personal Information will remain protected in a manner consistent with standard applicable data protection laws.
Not stated here
The safeguards are not described, and the "standard applicable data protection laws" are not named.
Data Access & Collection · Company commitment
The Services are not directed to children under 13; the Company directs under-13 users not to use them
The Policy says the Services are neither directed to nor structured to attract children under 13. The Company says it does not intend to collect Personal Information from anyone it knows to be under 13, and that it will direct potential users under 13 not to use the Services.
Supporting quotations
The Services are neither directed to nor structured to attract children under the age of 13 years. Accordingly, the Company does not intend to collect Personal Information from anyone it knows to be under 13 years of age. The Company will direct potential users under 13 years of age not to use the Services.
Qualifications & exceptions
The non-collection statement is about intent and about people the Company "knows" to be under 13.
Not stated here
The passage does not describe how age is checked or how potential users under 13 are directed away.
Retention & Deletion · Company commitment
The Company will take steps to delete under-13 information it learns was collected without verifiable parental consent
The Policy says that if the Company learns that Personal Information of persons less than 13 years of age has been collected without verifiable parental consent, it will take the appropriate steps to delete this information. It adds that, to make "such a request", you should contact the Company at privacy@huggingface.co.
Supporting quotations
If the Company learns that Personal Information of persons less than 13 years of age has been collected without verifiable parental consent, the Company will take the appropriate steps to delete this information.
To make such a request, please contact the Company at: privacy@huggingface.co.
Qualifications & exceptions
The deletion commitment is triggered when the Company learns of collection without verifiable parental consent.
Not stated here
The passage does not say what "such a request" refers to, and does not say what happens when verifiable parental consent has been obtained.
Data Access & Collection · Permission or license
The Company may collect your email address to send information and respond to inquiries and requests
The Company says it may collect your email address in order to send information and respond to inquiries and other requests or questions.
Supporting quotations
The Company may collect your email address in order to send information and respond to inquiries and/or other requests or questions.
Account & Service Control · Company commitment
The Company states email practices under CAN-SPAM and says it honors unsubscribe requests
Under a heading that refers to the CAN-SPAM Act, the Company states that it does not use false or misleading subjects or email addresses, reasonably identifies advertisements, and includes the physical address of its business location in its communications. It says it honors opt-out and unsubscribe requests, and that Users may follow the instructions at the bottom of an email from the Company to unsubscribe from correspondence.
Supporting quotations
8. COMMUNICATIONS AND CAN-SPAM ACT
The Company does not use false or misleading subjects or email addresses. The Company reasonably identifies advertisements and includes in its communications the physical address of its business location. The Company honors opt-out/unsubscribe requests. Users may follow the instructions at the bottom of an email from the Company in order to unsubscribe from correspondence.
Qualifications & exceptions
The unsubscribe route described is the instructions at the bottom of an email from the Company.
Not stated here
The Policy does not explain the CAN-SPAM Act itself in this passage, so which emails the statements cover is not spelled out beyond "communications" and "correspondence" from the Company.
Account & Service Control · Procedure
Questions about the Policy and data transfers can be sent to privacy@huggingface.co
The Policy gives privacy@huggingface.co as the contact for "any other question" at the end of the section on location of processing and data transfers, and for questions about the Policy.
Supporting quotations
If you have any other question, please contact the Company at: privacy@huggingface.co.
If you have questions about this Policy, please contact privacy@huggingface.co.
Legal Rights & Agreement Rules · Context
The EU main establishment is Hugging Face, SAS in Paris, under the French data protection agency (CNIL)
The Policy states that the main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under number 822 168 043, with headquarters at 9 rue des Colonnes, 75002 Paris, France. It says this designation gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL), per the GDPR. The Policy elsewhere states that Hugging Face is under an obligation to notify Users of the legal basis for processing under data protection laws, especially the GDPR.
Supporting quotations
The main establishment in the European Union is Hugging Face, SAS, a French société par actions simplifiée à associé unique registered in the Paris Trade and Companies Register under the number 822 168 043, and whose headquarters are located on 9 rue des Colonnes, 75002 Paris, France. The designation of this main establishment in the European Union gives full authority to the French Data Protection Agency, la Commission Nationale de l'Informatique et des Libertés (CNIL) per the General Data Protection Regulation (GDPR).
Hugging Face remains under an obligation to notify the Users about the legal basis on which their Personal Information is processed.
Qualifications & exceptions
The statement is framed in terms of the GDPR and the EU.
Not stated here
The passage does not say how this establishment relates to the Hugging Face, Inc. entity that the Policy names as "the Company".
Sharing & Disclosure · Company practice
The Company may share information with Third-Party Service Providers and ensures compliance with data protection laws
The Company says it may share your information with Third-Party Service Providers and that when it does, it ensures they access the information in compliance with applicable data protection laws. The list that follows is given in the format Subprocessor, Description of Subprocessing, and Location of Subprocessing. The sharing section separately says that companies hired for limited services will be permitted to obtain only the Personal Information they need to deliver the relevant service.
Supporting quotations
We may share your information with Third-Party Service Providers, and when we do, we ensure that they access your information in compliance with applicable data protection laws. The following list respects the format Subprocessor | Description of Subprocessing | Location of Subprocessing.
Those companies will be permitted to obtain only the Personal Information they need to deliver the relevant service.
Qualifications & exceptions
The compliance statement is about access "in compliance with applicable data protection laws".
Not stated here
The passage does not say how the Company ensures compliance, or which providers receive which information.
Sharing & Disclosure · Context
The Policy lists eleven subprocessors with their function and location
The list of Third-Party Service Providers gives, for each, a description of the subprocessing and a location: Discourse (Forum, United States); AWS SES (Emails, United States); Amazon Web Services, Inc. (Hosting/Infrastructure, United States); Metronome (Billing, United States); Stripe (Payment, United States); MongoDB Atlas (Hosting/Infrastructure, United States); Google Cloud Platform (Hosting/Infrastructure, United States/EMEA); GitHub (Hosting code, United States); OVHCloud (Hosting/Infrastructure, France); Slack Technologies (Communication, United States); and Hugging Face SAS ("All of the above", France).
Supporting quotations
Discourse | Forum | United States
AWS SES | Emails | United States
Amazon Web Services, Inc. | Hosting/Infrastructure | United States
Metronome | Billing | United States
Stripe | Payment | United States
MongoDB Atlas | Hosting/Infrastructure | United States
Google Cloud Platform | Hosting/Infrastructure | United States/EMEA
GitHub | Hosting code | United States
OVHCloud | Hosting/Infrastructure | France
Slack Technologies | Communication | United States
Hugging Face SAS | All of the above | France
Qualifications & exceptions
Each entry gives a function description and a location as written in the list.
Not stated here
The list does not say which categories of information each provider receives. It does not say whether "All of the above" for Hugging Face SAS means every function listed.
Use & Processing · Context
Some listed subprocessing is located in EMEA and France rather than only the United States
In the list of Third-Party Service Providers, most entries show United States as the location. Google Cloud Platform (Hosting/Infrastructure) shows United States/EMEA, OVHCloud (Hosting/Infrastructure) shows France, and Hugging Face SAS ("All of the above") shows France.
Supporting quotations
Google Cloud Platform | Hosting/Infrastructure | United States/EMEA
OVHCloud | Hosting/Infrastructure | France
Hugging Face SAS | All of the above | France
Qualifications & exceptions
The entries are read as written; "EMEA" is not further defined in the list.
Not stated here
The list does not say which countries "EMEA" covers.